1373 matches found
CVE-2025-66037
OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, feeding a crafted input to the fuzzpkcs15reader harness causes OpenSC to perform an out-of-bounds heap read in the X.509/SPKI handling path. Specifically, scpkcs15pubkeyfromspkifields allocates a zero-length buffer...
Ghidra Software Reverse Engineering Framework 安全漏洞
Ghidra Software Reverse Engineering Framework is an open-source software reverse engineering framework developed by the National Security Agency. Versions of the Ghidra Software Reverse Engineering Framework prior to 12.0.3 contained security vulnerabilities. These vulnerabilities stemmed from...
PT-2026-38207
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 148.0.7778.96 Description An inappropriate implementation in Preload allows a remote attacker to leak cross-origin data through the use of a crafted HTML page. Recommendations Update to version 148.0.7778.96 or...
CVE-2026-33739
Summary: CVE-2026-33739 affects the FOG project (cloning/imaging/rescue suite). Before version 1.5.10.1812, listing tables on multiple management pages (Host, Storage, Group, Image, Printer, Snapin) were vulnerable to Stored Cross‑Site Scripting (XSS) due to insufficient server‑side parameter san...
PT-2026-28518
Name of the Vulnerable Software and Affected Versions MyTube versions prior to 1.8.69 Description MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.8.69, an authorization bypass exists in the /api/settings/import-database API endpoint. This bypass allows...
CVE-2026-32865
OPEXUS eComplaint and eCASE before version 10.1.0.0 include the secret verification code in the HTTP response when requesting a password reset via 'ForcePasswordReset.aspx'. An attacker who knows an existing user's email address can reset the user's password and security questions. Existing...
SUSE CVE-2026-26196
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and accesstoken, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2...
CVE-2025-70952
pf4j before 20c2f80 has a path traversal vulnerability in the extract function of Unzip.java, where improper handling of zip entry names can allow directory traversal or Zip Slip attacks, due to a lack of proper path normalization and validation...
CVE-2026-33668
Vikunja vulnerability (CVE-2026-33668) affects versions prior to 2.2.1. When a user is disabled or locked, status checks are enforced only on local login and JWT refresh paths; API tokens, CalDAV basic auth, and OpenID Connect do not verify user status, allowing disabled/locked users to continue ...
CVE-2026-4704 Denial-of-service in the WebRTC: Signaling component
Denial-of-service in the WebRTC: Signaling component. This vulnerability was fixed in Firefox 149, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9...
UBUNTU-CVE-2026-4750
Out-of-bounds Read vulnerability in fabiangreffrath woof.This issue affects woof: before woof15.3.0...
Rapidvms 安全漏洞
Rapidvms is a video surveillance management system developed by linkingvision. There were security vulnerabilities in versions prior to Rapidvms PR96, and these vulnerabilities stemmed from improper restrictions on memory buffer operations...
CVE-2026-29840
JiZhiCMS v2.5.6 and before contains a Stored Cross-Site Scripting XSS vulnerability in the release function within app/home/c/UserController.php. The application attempts to sanitize input by filtering...
CVE-2026-33123 pypdf has inefficient decoding of array-based streams
pypdf is a free and open-source pure-python PDF library. Versions prior to 6.9.1 allow an attacker to craft a malicious PDF which leads to long runtimes and/or large memory usage. Exploitation requires accessing an array-based stream with many entries. This issue has been fixed in version 6.9.1...
CVE-2026-4461
Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
DEBIAN-CVE-2026-4445
Use after free in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2026-4463
Heap buffer overflow in WebRTC in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...
CVE-2026-4458
Use after free in Extensions in Google Chrome prior to 146.0.7680.153 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: High...
CVE-2026-4453
CVE-2026-4453 affects Google Chrome on macOS, due to an integer overflow in Dawn that could allow a remote attacker to leak cross-origin data via a crafted HTML page. Affected Chrome builds are prior to 146.0.7680.153 (per Chromium Chrome advisories and Debian/chromium security updates). Remediat...